CVE-2024-7161: SeaCMS Password Change cross-site request forgery

Published Jul 28, 2024

Updated

A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272575.

Affected Software

1 affected component

SEACMS SEACMS=13.0

Event History

Jul 28, 2024

CVE Published

via MITRE·03:31 PM

Data Sourced

via MITRE·03:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-7161?

CVE-2024-7161 is classified as a problematic vulnerability.

How do I fix CVE-2024-7161?

To fix CVE-2024-7161, update SeaCMS to the latest version or apply any available security patches.

What component is affected by CVE-2024-7161?

CVE-2024-7161 affects the Password Change Handler in SeaCMS 13.0.

What type of vulnerability is CVE-2024-7161?

CVE-2024-7161 is a cross-site request forgery (CSRF) vulnerability.

Which version of SeaCMS is impacted by CVE-2024-7161?

SeaCMS version 13.0 is impacted by CVE-2024-7161.